Analysis
- user interaction
yes - max time kernel
21s - max time network
18s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/04/2026, 03:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bit.ly/3dj9sww
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
300 seconds
General
- Target https://bit.ly/3dj9sww
- Sample260428-dnlf9ads4v
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1280 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218193812273863" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5452 chrome.exe 5452 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe Token: SeShutdownPrivilege 5452 chrome.exe Token: SeCreatePagefilePrivilege 5452 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe 5452 chrome.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5452 wrote to memory of 5860 5452 chrome.exe 86 PID 5452 wrote to memory of 3248 5452 chrome.exe 87 PID 5452 wrote to memory of 3248 5452 chrome.exe 87 PID 5452 wrote to memory of 1280 5452 chrome.exe 88 PID 5452 wrote to memory of 440 5452 chrome.exe 89 PID 5452 wrote to memory of 440 5452 chrome.exe 89 PID 5452 wrote to memory of 5468 5452 chrome.exe 92 PID 5452 wrote to memory of 5524 5452 chrome.exe 91 PID 5452 wrote to memory of 5468 5452 chrome.exe 92 PID 5452 wrote to memory of 5524 5452 chrome.exe 91 PID 5452 wrote to memory of 2156 5452 chrome.exe 93 PID 5452 wrote to memory of 2156 5452 chrome.exe 93 PID 5452 wrote to memory of 5664 5452 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/3dj9sww1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd8f5c728,0x7ffcd8f5c734,0x7ffcd8f5c7402⤵PID:5860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4013819829187919354,5505177357782795629,262144 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1552,i,11860829821609217305,17329047140092151438,524288 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:32⤵
- System Time Discovery
PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,17213778008693035641,2328814300418401789,524288 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2552 /prefetch:82⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,18102954104152352821,15492856673777385927,2097152 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:5524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,673413542963621400,7084455948010555700,2097152 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:5468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,9766191290936763734,1604973305142491233,2097152 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4324 /prefetch:22⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,10624232175376528809,18274732543151524096,524288 --field-trial-handle=2024,i,9581700313975235462,4901043556837245253,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4712 /prefetch:82⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 49a2897ee4678d9d8fff15c128bc39e7392da0406671a59acc65986f879c3c76
- MD5 b3fd658e38ac2af88f1b23fd1500d63f
- SHA1 c8f24a09b10f0616fc9a95c5d03c6b12194ccfc2
- SHA512 ce2191646b8ca94971b984400d7068273986618794c6d5da38d4fd7c80c879c72b8eaf85f23e83ee781d1d563585a4f4d30908dd03c2f8ec771309b8ef6bdb74
- TLSH T1CCE02BDBC971FC2714FD17B874540646E64503463B504D5F3E3D920C8FB9A3A028282C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6f023b5b41cfbdc2880898024889478501f49cfaac3e0149683f6dc231ba3c0d
- MD5 4e9f98d1d5a71b7e26ce7338b1dcf7c8
- SHA1 31422f4b9a55ac97e2469616f1b5f40fb76fef0d
- SHA512 89da1c3fe47007f4aed1c312cdcc1815bbcad66becb7259d9b21e3382a2818d2a97cb39dacd705980a14d7f91eb53f2f4b94c37fefc2abb3adc987e419cfeced
- SSDEEP 192:VORDO9xN8GZdf2tiv7tYpAPRp2h8B9CHsb+WNn9IeSFC2/BnArLaAqkp9VyIsnAC:VORDO90RtuhYUXe44w9Nf2hqaeLe
- TLSH T1DC42C72EA914693B8DCBD229FD617767DBF5102131D42E94EBFC8A2C14E75CD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
- MD5 d25832a19ff9c1c57c95ef5ecf3d457d
- SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
- SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
- SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
- TLSH T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 bb7e488bccf5f55ed7252f62502257b67357560005d128bc5bef0057f2c59059
- MD5 3645c00465310c852b770f1c0e44c455
- SHA1 6fe91a8b3a2e8947204399a017706756d7ada8e3
- SHA512 184f2a2b0acfa9740b48b7cf4ac192a1c3befa2494ad07b75aba89ff266ca5655e62491952ad31452faf9ba20ac9ef1632fae9e3be4432e82a68b1ec1975610e
- TLSH T154B0129080026A02C08302B151821488B1945F148706130193E0E9B1DC365A141146B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585f32.TMP
- Size 96B
- SHA256 cfe5585fdcfdf23b4a80ef0e702b3ffd89bcc5500a6cf64d61520fb7845df830
- MD5 840b3b26709bf9e821c206035cbffc2b
- SHA1 49de5f014983dd367ab51210bb168cf9be78894d
- SHA512 46a035879b000c22de9f4fd277180de2742e71f10c1c9dc2eca7583c949cc2420e55965524d710e9ae371de40a93b94b8cacd6f93404f00e1415b08b860709e7
- TLSH T196B02230C2032202C00203F032A883CCB0A0CF28C203322282F00AAACC232300028230
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 97c41ed3af03d22d5b6888fdfc745c807ddae495b470d77a39746423debc512e
- MD5 8d74dd3b848e004d413abdec3378bb6d
- SHA1 90cf9a551e2c6885b3d5da6d06a3abea8062f99d
- SHA512 0fbd3199a6b8a6f829ba97c9371ffd42c17defd46d0f85a1b3c34be47fd73b8a85275348e51eb3ce4bd32c93cfeb86ba5331af40e2cf0dd605a56819b7ab8895
- SSDEEP 1536:nScYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:S3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T1039312BA9E1A45E755BE4A9176AE780ACE12130D309FB9CC726C538C21D41CD2B73E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 0a96df368ab42e68ee613e2076679176ddde75c5b28002e2d3a93386535d149f
- MD5 3b59684e0f61c807ee65b9fc13c9c044
- SHA1 c93b884ae066229ddd153903def56b0aa7c4b65b
- SHA512 9739fa5801e17e6e8fa5cfdbba610e5f3551338c511f47a8e4328ec922102bfc5b05f8762275511ee2f718d2919beda9e5d9de9d2769b5880664bacdd764e4de
- SSDEEP 1536:0N0cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:I03Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T17E9312BA4E1A46E7957E4AC176AD7808CE12130D70AFA9CC316C639D61D41C92B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH